High
CVE-2026-33485
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 620
Reset filters
High
CVE-2026-33483
AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php
High
CVE-2026-33482
AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()
Critical
CVE-2026-33351
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
Low
CVE-2026-33296
AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php
High
CVE-2026-33295
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php
High
CVE-2026-33293
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
Medium
CVE-2026-33051
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
Medium
CVE-2026-33035
Unauthenticated Reflected XSS via innerHTML in AVideo
High
CVE-2026-32813
Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
Medium
CVE-2026-32757
Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection
Critical
CVE-2026-32817
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
Medium
CVE-2026-32812
Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint
High
CVE-2026-31887
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
Medium
CVE-2026-31859
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization
Medium
CVE-2026-31822
Sylius has a XSS vulnerability in checkout login form
Low
CVE-2026-29177
Craft Commerce has stored XSS in Craft Commerce Order Details Slideout
Medium
CVE-2026-29176
Craft Commerce has stored XSS in Inventory Location Name
High
CVE-2026-29174
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
Medium
ghsa-qrfh-cc86-vc8c
Leantime has HTML injection through firstname and lastname fields
Medium
CVE-2026-3241
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
Medium
CVE-2026-28784
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI
Medium
CVE-2026-28783
Craft CMS has Twig Function Blocklist Bypass
Critical
CVE-2026-28697
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.